DISCLAIMER: This page is for information only. It is not legal, financial or procurement advice and does not replace your own due diligence. Licenses, ownership, features and certifications can change: confirm what your decision rests on with the official sources.
🩺 Vitals
- 🟢 Last active: 2026-11-04
- 📦 Latest release: 1.19.0 (2026-11-04)
- 🐞 Open issues: 1214
- 🌟 Stars: 160.4k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent stable version the maintainers published as a release on the forge. Some healthy projects publish only tags, or publish their versions elsewhere.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: dify.ai
- Source: github.com/langgenius/dify
- License: Modified Apache License 2.0 (core; paid edition under its own terms)
- Deployment: Docker Container
- Jurisdiction: United States 🇺🇸 (LangGenius, Inc.)
- Compliance (SaaS): Dify Cloud security and compliance page
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: High (4/5) - A single-node stack of seven core services and eight components, among them PostgreSQL, Redis, a vector database and isolated code-execution sandboxes
- Maintenance: High (4/5) - Most feature releases add manual upgrade steps (new required services and variables, staged vector-store upgrades); schema migrations run on start, so back up the volumes first
- User Management: Moderate (3/5) - Invited members with four built-in workspace roles, HTTPS once you enable it; SSO, custom roles, SCIM and audit logs come only in the paid edition
What the scores mean: Reading the Scores
1. The Executive Summary
What is it? Dify is a platform for building LLM applications: AI workflows and agents drawn on a visual canvas, RAG pipelines, and model management across hosted and self-hosted models. Every app it builds comes with an API, so teams can call it from their own software. It serves developers and AI teams building internal assistants and automations. The paid edition adds several workspaces with quotas and billing per business unit, and encryption with the customer's own keys.
The Strategic Verdict:
- 🔴 For companies building a multi-tenant or white-labelled product: Caution. Running more than one workspace needs a commercial license, and the Dify logo may not be removed from the frontend (License Risk).
- 🟢 For AI teams building internal apps on their own servers: Conditional Buy. Workflows, RAG pipelines and agents run on your infrastructure with hosted or self-hosted models, as long as one workspace is enough (What is it?, License Risk).
2. Cost of Ownership
| Cost Component | Dify (Self-Hosted) |
|---|---|
| Pricing Model | No license fee; license restricts some uses (License Risk); paid edition for some features |
| Operations | Single VM, several services (API, workers, sandboxes, vector database), grows with queue load; plus your team's time to run it (Maintenance, in the Profile) |
| Support | From the vendor: Dify Cloud, a managed service, and paid support for self-hosted installs (enterprise support); elsewhere, a paid service provider |
| AI Models | Paid to your model provider (per token) |
| Exit | App export (Dify DSL, YAML); leaves out knowledge-base data, tool API keys and usage logs |
What each row covers: Total Cost of Ownership
3. Risk Assessment
- Jurisdiction: LangGenius, Inc., the project's vendor, is registered in the United States, under US law. The vendor runs Dify Cloud, a hosted service where your data can live; its hosts include a party domiciled in or controlled from the US. Data in Dify Cloud is within reach of the US CLOUD Act wherever it is stored, since its operator is based in the US. A self-hosted install sends usage data to the vendor unless the operator switches it off. US law can compel the recipient to hand over that usage data. LangGenius's privacy policy lets data be stored and processed wherever its affiliates operate, China among them.
- The Compliance Shift: The bundled Weaviate vector database also sends usage data to Weaviate B.V. by default, under its own setting apart from Dify's. Self-hosting moves the security and compliance duties of running the software to the operator (the operator's compliance checklist). Any audit of Dify Cloud (such as SOC 2 or ISO 27001) covers the vendor's own systems, never your install.
- License Risk: Dify is under the Modified Apache License 2.0, a custom source-available license that is not OSI-approved. The project moved to these terms from the Dify Open Source License in 2024. The vendor holds the rights to relicense contributed code through a contributor agreement, so future versions can move to other terms without contributors' consent. A commercial license is needed to run a multi-tenant environment, and the license counts each workspace as a tenant, so a free deployment stays at one workspace. The Dify logo and copyright information in the console and in apps built with it may not be removed or changed, a term that does not apply when the frontend is not used. Everything else follows Apache-2.0.
4. Market Landscape
🏢 Proprietary Incumbents
- Microsoft Copilot Studio: Copilot Studio is Microsoft's low-code cloud studio for building AI agents and workflows.
Data held by: Microsoft Corporation, United States 🇺🇸, subject to the US CLOUD Act for the data it holds, wherever it is stored.
Why teams leave: Encryption with its customers' own keys needs a top Microsoft 365 plan or a compliance add-on.
Exit: Agents as solution files (ZIP) or YAML; transcripts as CSV or through the Dataverse Web API, partial export (channel and authentication settings)
🤝 Open-Source Alternatives
- LangFlow: MIT-licensed Python-native visual IDE for AI Agents and RAG pipelines: a drag-and-drop GUI for LangChain that exports straight to code.
- AnythingLLM: The all-in-one desktop AI application for RAG, AI Agents, and No-Code automation. Run LLMs locally with full data privacy.